Between the Google autoupdater (ksfetch) being installed with Chrome, and Homebrew doing autoupdate and downloading package hashes from Microsoft/GitHub, this now means that both Google and Microsoft, both with ties to the US military, have RCE on most developer macOS workstations.